Extracted

• • Target

    antA_bump.jpeg

  • Size

    318KB

  • MD5

    18a72001b9043aa1dcd0471e1c3f79f0

  • SHA1

    8614f3ff60027912dbf4a3c8775b6504a381342f

  • SHA256

    af4fc7a1f4d6ebea7eeb15f584e84af31b5c0b15c53dafacf1d069731963b1c4

  • SHA512

    1d3a27305533bd5f5fe401f380936475055128a24c5e09d7a87320c4858a3c424b0f6f2dc9555598ebf1dee8ff1d351c9720e39c93440f2dd508fbdc963e0679

  • SSDEEP

    6144:ze4jYM6hiZE9xguZYcvTvgvXFdGVTfqEdh4ifCywWPP74VW04iy+CLp0FMeZrkBr:zjYMkZxguZvv8vfGVTfqEUGCyXcPFmpN

  Score

  10^/10

  metasploitbackdoordiscoverypersistencephishingtrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2